Apple Safari blocks identity resolution services that convert emails into tracking IDs
New anti-tracking measures in Safari and WebKit prevent third parties from linking email addresses to persistent user profiles.
Key points
- Safari blocks network access to infrastructure used by identity resolution services.
- The feature prevents third parties from creating persistent tracking IDs from user emails.
- Protections are included in iOS 27, iPadOS 27, macOS 27, and visionOS 27.
Apple has introduced new anti-tracking protections in Safari and the WebKit engine that block connections to identity resolution services. According to Help Net Security, these measures prevent third parties from converting user email addresses into persistent tracking identifiers. This update targets a specific "post-cookie" tracking method that has become prevalent in recent web analytics and advertising practices.
The WebKit team explained that these services allow third parties to collect email addresses when users log in or sign up for newsletters. The provider then sends the address to its servers to create a permanent tracking ID. This identifier is returned to the webpage and stored there for future use.
How Identity Resolution Works
This tracking method enables providers to build comprehensive profiles known as identity graphs. These graphs can contain names, phone numbers, home addresses, IP addresses, and website account details. By linking this data, providers can track a person’s activity across multiple websites and devices. Email addresses are particularly effective for this because users often keep the same address for decades.
The WebKit team noted that the tracking ID stored on the website can be used for arbitrary purposes. This includes building detailed browsing profiles or targeting advertisements at the user across different sites. Even if a user logs out or unsubscribes from a newsletter, the identifier and email address remain stored with the third party.
Scope and Implementation
Safari and WebKit block network access to the infrastructure embedded in webpages that collects these email addresses. This protection operates at the domain level, which prevents providers from bypassing the block by changing the structure of their network requests. The goal is to stop the transmission of email addresses to provider servers without visible indication to the user.
WebKit states that these protections are designed to preserve first-party personalization while stopping cross-site tracking. The measures are included in Apple’s iOS 27, iPadOS 27, macOS 27, and visionOS 27 releases. Users can further limit email-based tracking by using services like Hide My Email, available with iCloud+, which creates unique randomized addresses for individual websites.
What should you do?
Organizations relying on third-party analytics should review their data collection methods to ensure compliance with these new browser restrictions. Users on Apple devices should verify they are running the latest operating system versions to benefit from these protections. Those concerned about privacy should consider using email masking services to prevent their primary address from being used as a tracking identifier.
What to do and how to stay safe: Apple
- Update devices to iOS 27, iPadOS 27, macOS 27, or visionOS 27 to enable the new anti-tracking protections.
- Use email forwarding services like Hide My Email to create unique addresses for different websites and newsletters.
- Review third-party analytics and advertising integrations to ensure they do not rely on blocked identity resolution methods.
- Monitor browser updates for further enhancements to privacy features that target post-cookie tracking techniques.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does Safari block email-based tracking?
Safari blocks network access to the infrastructure used by identity resolution services, preventing webpages from sending email addresses to third-party servers.
What is an identity graph?
An identity graph is a profile built by combining information such as names, phone numbers, and IP addresses to link a person’s activity across websites and devices.
Which Apple operating systems include these protections?
The protections are included in iOS 27, iPadOS 27, macOS 27, and visionOS 27.
